GitHub Advisoryadvisory · Maven

GHSA-cf8f-w2c5-p5jr keycloak vulnerable to unauthorized login via mail server setup

CRITICAL Published 2022-05-24 Modified 2023-11-06 Official page ↗
Aliases
CVE-2019-14837
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-547, CWE-798
Reviewed
2022-09-12

Affected packages

• Maven org.keycloak:keycloak-core: < 8.0.0 → fixed in 8.0.0

Description

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be '[email protected]'.

Related

Alias · CVE (1)

  • CVE-2019-14837 A flaw was found in keycloack before version 8.0.0. vulnerability

Weakness · CWE (2)

  • CWE-547 Use of Hard-coded, Security-relevant Constants weakness
  • CWE-798 Use of Hard-coded Credentials weakness

References